An administrator already collects interface throughput with SNMP but cannot tell which hosts or applications are consuming a saturated link. Which capability does flow data such as NetFlow add over SNMP interface polling?
- AFlow data breaks utilisation down by conversation, exposing the source and destination addresses, ports, and protocols that SNMP reports merely as an aggregate byte count. Correct
- BFlow data reports the temperature, fan speed, and power draw of the device chassis, environmental facts that SNMP interface counters cannot expose.
- CFlow data encrypts the management channel between the device and the collector, closing the clear-text exposure that SNMPv2c polling leaves open.
- DFlow data guarantees loss-free delivery of every record over TCP, whereas SNMP counter polling is dropped first on a congested link.
Why A is correct: Correct: flow records carry the addressing and port fields for each conversation, so utilisation that SNMP reports as one aggregate counter can be attributed to specific hosts and applications.
Why B is wrong: Chassis temperature and power come from environmental sensors, not flow records, so this describes a different sensor type and is not what flow data adds over SNMP.
Why C is wrong: SNMPv2c is indeed clear text, which makes encryption sound relevant, but flow export does not encrypt management traffic; that is a security control unrelated to what flow data reveals.
Why D is wrong: Flow records are commonly exported over UDP, not guaranteed TCP delivery, so this misstates the transport and is not the advantage flow data provides over SNMP.